Summary

  • AFRINIC’s 2025 Annual Report records 1,073 RPKI certificates, 11,216 ROAs, 11,540 IPv4 prefix entries and 816 IPv6 prefix entries for Q4 2024.
  • In the daily CSV downloaded on 18 October 2026, those four values do not occur on one date row. The report’s ROA and IPv4 figures appear together on 1 January 2025; the certificate and IPv6 figures appear together on 31 December 2024.
  • The 31 December 2025 row matches all four Q4 2025 report values. That makes the later endpoint reproducible from today’s export, but not the earlier baseline as a single daily state.
  • Recalculation changes the reported ROA decline from 0.86% to 2.21% and the IPv4-prefix increase from 84.6% to 83.4%; both comparisons still show fewer ROAs and substantially more IPv4 prefix entries.
  • AFRINIC should attach an as-of time, metric definitions, extraction method and immutable snapshot or revision identifier to each quarterly table. The evidence shows a reproducibility gap, not which source is wrong.

Analysis

The table in AFRINIC’s 2025 Annual Report looks unusually easy to check. Four indicators, two quarter-end columns and a percentage change: certificates issued, ROAs, IPv4 prefixes covered by ROAs, and IPv6 prefixes covered by ROAs. For Q4 2024 it reports 1,073, 11,216, 11,540 and 816. For Q4 2025 it reports 1,254, 11,120, 21,307 and 916. The current public series reproduces the second set together on 31 December 2025. It does not reproduce the first set together on any one date in the downloaded file.

That conclusion is narrow but testable. AFRINIC’s RPKI portal links to a daily CSV with a date field and separate columns for certificates, ROAs, ASNs in ROAs, IPv4 prefixes and address space in ROAs, and IPv6 prefixes and address space in ROAs. The file retrieved on 18 October 2026 ends on 17 October. Its 31 December 2024 row has 1,073 certificates and 816 IPv6 prefix entries, but 11,371 ROAs and 11,620 IPv4 prefix entries. On 1 January 2025 the row has 1,073 certificates, 11,216 ROAs and 11,540 IPv4 prefix entries, but 809 IPv6 entries. The report’s four values are split across those observations.

The split matters because a reader may reasonably expect “Q4 2024” to mean a named date or a defined quarter-end capture that can be recovered from the linked historical series. The report does not state a time, timezone, query or snapshot identifier beside the table. The CSV uses calendar dates, but its header and the chart page do not say when each daily observation was taken or whether old rows can later be revised. It is therefore possible that the report and export answer different questions: one may reflect a particular extraction, while the other is the current view of a time series.

The published materials do not settle that possibility.

The arithmetic demonstrates why a source receipt would help. Using the report’s figures, ROAs fall from 11,216 to 11,120, or 0.86%, while IPv4 prefix entries rise from 11,540 to 21,307, or 84.64%. Using the current CSV’s 31 December rows, ROAs fall from 11,371 to 11,120, or 2.21%, and IPv4 prefix entries rise from 11,620 to 21,307, or 83.36%. The size of the change moves; its direction does not. This is not a reversal of the story, and it is not evidence that the annual report contains an error. It is a reason a reader cannot independently reconstruct two reported percentages from the historical download as it stands today.

There is a second reason to keep the units distinct. A ROA is a signed authorization associating an autonomous system with one or more IP prefixes. “ROAs” counts objects; “prefixes in ROAs” counts entries within those authorizations. One can rise as the other falls when authorizations are consolidated. AFRINIC itself offers that as a possible explanation for the 2025 pattern: fewer ROAs alongside more IPv4 prefix entries may reflect more efficient or aggregated ROAs. Neither count, alone or together, tells a reader how many BGP routes were Valid, Invalid or NotFound under route-origin validation.

That assessment also depends on the announced route and its origin AS. A count of authorization entries is not a measure of filtering, deployment or security outcomes.

The repair is modest. Give each quarterly figure a compact data receipt: an exact as-of timestamp and timezone; a definition and unit for every column; the query or extraction procedure; a stable file, snapshot or release identifier; and a revision history if historical rows change. Preserve the report table as published, then link it to the receipt. If a later release revises an observation, expose the old and new value and the reason. A reader should not have to guess whether a quarter-end label refers to midnight, a business-day extract or a report-preparation snapshot.

AFRINIC can close this gap without changing the headline or inventing a security claim. The most defensible reading remains that certificates and IPv4 prefix coverage grew, the number of ROAs edged down, and the scale of two year-on-year changes depends on which 2024 baseline is used. A timestamped, immutable extraction would let members, researchers and operators distinguish those findings for themselves. Until then, the later endpoint is reproducible; the earlier four-number baseline is not.

Sources